fix aarch64 killing lr

Author: mur47x111

compiler/src/jdk.graal.compiler/src/jdk/graal/compiler/lir/aarch64/AArch64ControlFlow.java

@@ -83,11 +83,19 @@ public ReturnOp(Value x, AllocatableValue tailCallTarget, AllocatableValue[] add
 
         @Override
         protected void emitCode(CompilationResultBuilder crb, AArch64MacroAssembler masm) {
-            crb.frameContext.leave(crb);
             if (Value.ILLEGAL.equals(tailCallTarget)) {
+                crb.frameContext.leave(crb);
                 masm.ret(lr);
             } else {
-                masm.jmp(asRegister(tailCallTarget));
+                try (ScratchRegister scratch = masm.getScratchRegister()) {
+                    Register jumpTarget = asRegister(tailCallTarget);
+                    Register preservedJumpTarget = scratch.getRegister();
+                    // frameContext.leave() can restore callee-saved registers (including lr),
+                    // so preserve the tail-call target across the epilogue.
+                    masm.mov(64, preservedJumpTarget, jumpTarget);
+                    crb.frameContext.leave(crb);
+                    masm.jmp(preservedJumpTarget);
+                }
             }
             crb.frameContext.returned(crb);
         }